Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Suggested Enhancement for ESCU Detection: Internal Horizontal Port Scan NMAP Top 20

Đang mở
  • Có gì không ổn?
#3,604 3 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
3/5
Thời gian dự kiến
1-2 ngày
Mức phù hợp với người mới
58/100
Loại issue
Tính năng
Độ rõ ràng
Khá rõ ràng
Mức độ hoạt động
Sôi nổi
Lĩnh vực
security

Hướng nghiên cứu

Start with the Internal Horizontal Port Scan NMAP Top 20 detection and compare its current SPL with the query included here. Check that the aggregation can measure destination-port diversity and that the rule retains the existing 250-destination-IP condition while requiring at least 5 NMAP ports; validate it using any existing detection checks.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

enhancement

Is your feature request related to a problem? Please describe.

The current Internal Horizontal Port Scan NMAP Top 20 detection rule in the Splunk ESCU content package may generate false positives in environments where legitimate internal services (e.g., load balancers, backup systems, patch management tools) connect to multiple internal hosts using a small set of common ports (e.g., HTTP, SMB, RDP). The rule triggers when a host connects to ≥250 distinct destination IPs on any of the top 20 NMAP ports in a 1-hour time window, which fails to account for the fact that legitimate services may generate high volumes of traffic across many IPs but only hit a few specific ports.
Describe the solution you'd like

I propose adding an additional condition to the rule that checks for the distinct number of destination ports. Specifically, the rule should only trigger if a host connects to at least 5 distinct destination ports within the NMAP top 20 port list, in addition to the existing condition of connecting to ≥250 distinct destination IPs. This would improve detection accuracy by distinguishing between malicious scanning activity and legitimate high-volume internal services that may hit many hosts but only target a few ports.
Describe alternatives you've considered

An alternative could be to add a whitelist or exception list for known legitimate services (e.g., backup systems, monitoring systems), but this may require ongoing maintenance and tuning to keep up with changing environments.

Another alternative could be to adjust the threshold for the number of distinct destination IPs, but this may still allow legitimate high-volume services to trigger false positives if they use a small number of ports.
Additional context

The current rule does not differentiate between:

Malicious horizontal scanning, where attackers probe many hosts across multiple ports,

Legitimate activities, where internal services like backup tools, patch management systems, and monitoring tools may generate high traffic volumes on a few ports but hit many hosts.

This enhancement would help reduce unnecessary alerts and improve SOC efficiency by focusing on true scanning activities.

The updated SPL query with the added port count condition would look as follows:

| tstats security_content_summariesonly values(All_Traffic.action) as action values(All_Traffic.src_category) as src_category values(All_Traffic.dest_zone) as dest_zone values(All_Traffic.src_zone) as src_zone count from datamodel=Network_Traffic where index=fortigate AND All_Traffic.action="allowed" All_Traffic.src_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") AND All_Traffic.dest_port IN (21, 22, 23, 25, 53, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5900, 8080) by All_Traffic.src_ip All_Traffic.dest_port All_Traffic.dest_ip span=1s _time All_Traffic.transport
| drop_dm_object_name("All_Traffic")
| eval gtime=_time
| bin span=1h gtime
| stats min(_time) as firsttime max(_time) as lasttime values(action) as action dc(dest_ip) as totalDestIPCount dc(dest_port) as TotalDestPortCount values(src_category) as src_category values(dest_zone) as dest_zone values(src_zone) as src_zone by src_ip dest_port gtime transport
| security_content_ctime(firsttime)
| security_content_ctime(lasttime)
| where totalDestIPCount>=250
| eval dest_port=transport + "/" + dest_port
| where TotalDestPortCount>=5
| stats values(action) as action sum(totalDestIPCount) as totalDestIPCount sum(TotalDestPortCount) as TotalDestPortCount values(src_category) as src_category values(dest_port) as dest_ports values(dest_zone) as dest_zone values(src_zone) as src_zone by firsttime lasttime src_ip gtime
| fields - gtime
| internal_horizontal_port_scan_nmap_top_20_filter

This approach minimizes false positives by accounting for port diversity while maintaining detection accuracy for true port scanning behaviors.

Ngôn ngữ chính
Python
Star
1.7k
Fork
502
Merge trung bình
3 ngày 16 giờ
Pull request đã merge (30 ngày)
55

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của splunk/security_content

Tất cả issue của splunk/security_content

Issue tương tự

Thêm issue về Python

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.